Auto Renew for Revoked Certificates (vault_pki_secret_backend_cert)

[Merenon]

Versions

• Vault Provider 2.18.0

Affected Resource(s)

Please list the resources as a list, for example:

• vault_pki_secret_backend_cert

Terraform Configuration Files

resource "vault_pki_secret_backend_cert" "client_certificate" {
  backend               = "pki"
  name                  = "my-client-cert"
  common_name           = "my-cn"
  private_key_format    = "pkcs8"
  ttl                   = (30 * 24 * 60 * 60)
  min_seconds_remaining = (5 * 24 * 60 * 60)
  auto_renew            = true
}

Expected Behavior

When the certificate has been revoked on the Vault side, the "auto_renew" feature should attempt to generate a new client certificate to ensure validity wherever it is references/used. Otherwise, there is no way to renew the certificate with Terraform, as it is still considered valid (based on the expiration date and current state).

Actual Behavior

Certificate revocation is not recognized by Terraform. Revoked certificate is still used for resources.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply - generate client certificate
2. Manually revoke the certificate within Vault
3. terraform plan - note that no changes are detected/planned